Tips to Set Up a Secure Server on Red Hat Linux

Data has become a crucial aspect of businesses today. Whether we talk about a company’s own data or their customer’s, it is integral to protect it. And for that to happen, setting up a secure server on Red Hat Linux is the key. With the right Red Hat system administrator training and certification course, you can become the one with the right skills and knowledge to make it happen.

But who do we need to protect the data from? Well, hackers are always in the search for servers with a less secure system. Companies know the kind of threat this can possess to their growth and expansion. Thus, the need for Red Hat experts is found. A system administrator is the one responsible for securing the Linux system.

As you complete your training and certification program, you will find yourself equipped with all the right knowledge and skills to make it happen. And while you will learn everything that needs to be learned, here are some tips for setting up a secure server on Red Hat Linux.

 

Tips to Set Up a Secure Serve on Red Hat Linux

There are a lot of tips and tricks that a system administrator uses while setting up a server on Linux. The aim is to ensure its security and get started in the right manner. To give you a headstart, we are here with some of the most useful and trusted tips to set up a secure server on Red Hat Linux.

The following details are based on the assumption that the user is using Debian/ Ubuntu or RHEL/CentOS based Linux distribution.

 

• Encrypt Data Communication

All the data that gets transmitted across a network is always open to monitoring. Thus, it is best to always encrypt the transmitted data, whenever possible. This can be done using certificates, keys, or passwords.

• With GnuPG, you can sign and encrypt your communication and data. Additionally, it boasts access modules and a multipurpose key management system for various public key directories.
• ssh, sftp, rsync, or scp can be used for file transfer. Special fuse and sshfs tools can be used for mounting your home directory or a remote server file system.
• OpenVPN is a well-known lightweight and cost-effective SSL VPN.

 

• Reduce the Software for Reduced Vulnerability in Linux

A lot of people make the mistake of installing unnecessary software. This haphazard collection of unwanted software only leads to additional vulnerabilities. Thus, the best step is to avoid installing software that is not needed.

To help with this deed, you can use RPM package managers like apt-get and/or dpkg  or yum to help review the installed software package sets on a system. You can also begin by uninstalling unwanted packages.

 

• Keep your Software and Linux Kernel UpToDate

In order to maintain Linux server, one needs to apply security patches. All essential tools are provided by Linux for keeping the system updated. This also facilitates in easy upgrades between various versions.

Every security update should be reviewed on time as well as applied at the earliest. For this, the RPM package manager like apt-get and/or dpkg or yum should be applied to all security updates.

• All security updates can be sent via a cron job.
• CentOS/ Red Hat/ Fedor Linux can be configured for sending yum packages update notifications through email.
• Apticron can be used under Ubuntu Linux/ Debian for sending security notifications.
• Apt command/ apt-get-command may also be used for configuring unattended upgrades for an Ubuntu Linux/ Debian server.

 

• Integrating a Strong Password Policy and User Accounts

The one thing you can do is to employ commands such as usermod or useradd for creating and maintaining user accounts. Additionally, integrating a strong password policy will also help you out.

pam_cracklib.so to can be configured for enforcing the password policy.

 

• Restrict the Use of Prior Passwords on Linux

Under Linux, you can ensure security by restricting the users from using their prior used passwords. This can be done with the aid of pam_unix module parameter remember.

 

• Ensure Only Root Accounts Have UID Set to 0

One of the key things that will help you to set up a secure server on Red Hat Linux is ensuring that only root accounts have UID set to 0. This command can be used to see which accounts have UID set to 0.

# awk -F: ‘($3 == “0”) {print}’ /etc/passwd

 

• Prefer Using FTPS, SFTP, or OpenSSH Services on Linux

When talking about most network configurations, it has come to notice that anyone within the same network and using a packet sniffer can capture passwords, transferred files, user names, FTP/ rsh/ telnet commands, and configurations. To ensure that this does not happen to your data, you can use FTPS, SFTP, or OpenSSH services.

You can use apt-get command/ apt command for removing insecure services is you are using Ubuntu Linux/ Debian based server.

 

• Promote One Network Service per VM Instance or System

The best way to go about is to run different network service on different VM instance or servers. Thus, one network service per VM instance or system should be the adopted model. In this way, even if a service gets compromised, the hacker will not be able to get hold of another service. Thus, limiting the amount of damage.

 

• Incorporate Linux Security Extensions

Linux is equipped with multiple security patches. These can be used for guarding against compromised or misconfigured programs. The best thing to do is to use SELinux or other Linux security extensions to help enforce limitations on network.

 

• Instil Password Aging

With the aid of the chage command, you can alter the number of days between the date when the password was last changed and the passwords changes. Hence, the user gets an update when they need to change the password again to ensure security.

 

• Locking User Accounts in case of Login Failures

The faillog command can be used under Linux for displaying fail log records as well as to set new login failure limits. This command can also be used to maintain failure limits and counters.

 

• Incorporate SELinux

One of the best things you can do to set up a secure server on Red Hat Linux is to use SELinux. It offers a flexible MAC or Mandatory Access Control. When a process or an application is run as a user (SUID or UID), it has the user’s permissions to objects like sockets, files, and other processes. When you run a MAC kernel, your system is protected from flawed or malicious applications that hold the potential to destroy or damage the system.

 

• Disable Root Login

The best course to take is to disable root login. Instead, go for sudo to execute root-level commands when necessary. It also offers simple tracking and auditing features.

 

• Delete X Window Systems

Your server does not require X Window systems. Thus, the best next step is to disable and remove X Windows. This will significantly improve the server security and performance.

 

• Physical Server Security

It is on you to protect Linux server’s physical console access. For this, configure the BIOS, then disable booting from any external devices like USB pen, DVDs, and CDS, and finally, grub boot loader password. Another key point to keep in mind is to install a security check for each person to pass before being able to access their server.

 

• Install Distinct Disk Partitions for Linux System

If you want to get a hold of a system that is better and more secure, then you need to separate your operating system files from user files. The following filesystems should be mounted on separate partitions for the best results.

• /usr
• /var and /var/tmp
• /home
• /tmp

Creating distinct partitions for FTP and Apache server roots is also a good step. After editing /etc/fstab file, add these configuration options –

• Nosuid
• Noexec
• Nodev

 

• Disable Unwanted SGID and SUID Binaries

The one thing to know is that all the files enabled with SGID or SUID bits hold the potential of being misused in the case that SGID/SUID executable faces any security troubles. The threat essentially arises from the fact that any remote or local user can access this file.

 

• Keep on IPv6 if you are using it

IPv6 or Internet Protocol version 6 offers an additional Internet layer of TCP/ IP protocol suite and has replaced IPv4. The number of benefits it offers are also many. However, if you are not using IPv6, it is best to turn it off.

 

• Be wary of World-Writable Files

World-writable files are such that they be modified by anyone. Hence, leading to security issues. You can use this command to know all the world writable files –

Find /dir -xdev -type d \ (-perm -0002 -a ! -perm -1000 \) -print

 

• Configure Logging and Auditing

One of the key things you need to do is to configure logging and auditing for collecting all cracking and hacking attempts.

By default, all data is stored is by syslog in /var/log/directory.

 

Conclusion

These tips to set up a secure server on Red Hat Linux make up only the tip of the iceberg. Once you complete of Red-hat system administrator training and certification course, you will be able to do much know. The span of your knowledge and skills will expand impeccably.

So, what are you waiting for? Get started now with the best institute!